Skip to main content
cve.nowby Sazabi
← npm
npmPackage

express-cart

4 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4
Registry
npm

Advisories 4

  • Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount…

    Affected: fixed in 1.1.17.

  • A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as…

    Affected: fixed in 1.1.6.

  • expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.

    Affected: fixed in 1.1.6.

  • Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.

    Affected: fixed in 1.1.7.